@vibiz/analytics 0.1.0 → 0.2.0

package/README.md

@@ -9,7 +9,7 @@ npm i @vibiz/analytics
 ```ts
 import { init, track, identify } from '@vibiz/analytics';
 
-init({ key: 'pk_live_xxx' });
+init({ workspaceId: 'org_xxx' });
 
 identify('cust_8842', { email: 'mario.rossi@example.com' });
 track('purchase', { value: 4200, currency: 'EUR', order_id: '84213' });
@@ -32,7 +32,7 @@ One implementation, two ways to reach it. If you have no bundler, skip this
 package entirely:
 
 ```html
-<script async src="https://www.vibiz.ai/sdk/v1/v.js" data-vibiz-key="pk_live_xxx"></script>
+<script async src="https://www.vibiz.ai/sdk/v1/v.js" data-vibiz-id="org_xxx"></script>
 ```
 
 ## Notes
@@ -42,8 +42,9 @@ package entirely:
   than throwing.
 - **Safe before the tag loads.** Calls are queued and replayed once it arrives,
   so you can track from the first line of your app.
-- **The key is public.** `pk_live_…` ships in the page source either way, like a
-  Meta pixel id. Traffic is bound to your workspace by allowed domains.
+- **The workspace id is public.** `org_…` ships in the page source either way,
+  like a Meta pixel id, which is why there is no separate key. Traffic is bound
+  to your workspace by the domains you allow.
 - **Contact details are never hashed here.** They are hashed by the collector,
   because a digest computed in a browser cannot be re-normalised — and
   normalisation is exactly where matching fails silently.

package/dist/index.cjs

@@ -30,7 +30,7 @@ function init(config) {
   script.id = SCRIPT_ID;
   script.async = true;
   script.src = config.scriptUrl ?? DEFAULT_SCRIPT;
-  script.setAttribute("data-vibiz-key", config.key);
+  script.setAttribute("data-vibiz-id", config.workspaceId);
   if (config.endpoint)
     script.setAttribute("data-vibiz-endpoint", config.endpoint);
   if (config.autocapture === false)

package/dist/index.d.cts

@@ -51,8 +51,14 @@ interface Contact {
     country?: string;
 }
 interface VibizConfig {
-    /** Public write key, `pk_live_…`. Safe in client code: it ships in the page source either way. */
-    key: string;
+    /**
+     * Your Vibiz workspace id, `org_…`.
+     *
+     * Public by design, and safe in client code: it ships in the page source of
+     * every tracked site either way, exactly like a Meta pixel id. Where an
+     * event may come from is decided by your domain allowlist, not by this.
+     */
+    workspaceId: string;
     /** Point this at a first-party subdomain to survive ad blockers. */
     endpoint?: string;
     /** Page views, clicks, form submits and time on page without any code. Default true. */

package/dist/index.d.ts

@@ -51,8 +51,14 @@ interface Contact {
     country?: string;
 }
 interface VibizConfig {
-    /** Public write key, `pk_live_…`. Safe in client code: it ships in the page source either way. */
-    key: string;
+    /**
+     * Your Vibiz workspace id, `org_…`.
+     *
+     * Public by design, and safe in client code: it ships in the page source of
+     * every tracked site either way, exactly like a Meta pixel id. Where an
+     * event may come from is decided by your domain allowlist, not by this.
+     */
+    workspaceId: string;
     /** Point this at a first-party subdomain to survive ad blockers. */
     endpoint?: string;
     /** Page views, clicks, form submits and time on page without any code. Default true. */

package/dist/index.js

@@ -26,7 +26,7 @@ function init(config) {
   script.id = SCRIPT_ID;
   script.async = true;
   script.src = config.scriptUrl ?? DEFAULT_SCRIPT;
-  script.setAttribute("data-vibiz-key", config.key);
+  script.setAttribute("data-vibiz-id", config.workspaceId);
   if (config.endpoint)
     script.setAttribute("data-vibiz-endpoint", config.endpoint);
   if (config.autocapture === false)

package/dist/node.cjs

@@ -4,7 +4,7 @@
 var DEFAULT_ENDPOINT = "https://www.vibiz.ai/api/ingest";
 var PROTOCOL_VERSION = 1;
 async function track(input) {
-  if (!input.key) return { ok: false, reason: "missing key" };
+  if (!input.workspaceId) return { ok: false, reason: "missing workspaceId" };
   if (!input.event) return { ok: false, reason: "missing event" };
   if (!input.visitorId && !input.userId && !input.contact) {
     return {
@@ -14,7 +14,7 @@ async function track(input) {
   }
   const body = {
     v: PROTOCOL_VERSION,
-    k: input.key,
+    k: input.workspaceId,
     n: input.event,
     vid: input.visitorId ?? `srv-${input.userId ?? "anon"}`
   };
@@ -26,15 +26,13 @@ async function track(input) {
     body.cad = true;
   }
   try {
-    const headers = {
-      // text/plain matches what the tag sends, so both halves hit the same
-      // parsing path on the collector rather than two that can diverge.
-      "Content-Type": "text/plain;charset=UTF-8"
-    };
-    if (input.serverKey) headers["x-vibiz-server-key"] = input.serverKey;
     const response = await fetch(input.endpoint ?? DEFAULT_ENDPOINT, {
       method: "POST",
-      headers,
+      headers: {
+        // text/plain matches what the tag sends, so both halves hit the same
+        // parsing path on the collector rather than two that can diverge.
+        "Content-Type": "text/plain;charset=UTF-8"
+      },
       body: JSON.stringify(body)
     });
     return response.ok ? { ok: true } : { ok: false, reason: `HTTP ${response.status}` };

package/dist/node.d.cts

@@ -37,17 +37,14 @@ interface ServerEventProperties {
     [key: string]: unknown;
 }
 interface ServerTrackInput {
-    /** Public write key. Says which workspace the event belongs to. */
-    key: string;
     /**
-     * Server key, from your Vibiz workspace. Unlike `key` this IS a credential:
-     * keep it in your environment and never send it to a browser.
+     * Your Vibiz workspace id, `org_…`. Says which workspace the event belongs to.
      *
-     * Required once the site has an origin allowlist, because a server call
-     * carries no `Origin` for that allowlist to check. Without it the allowlist
-     * would be bypassable by anyone willing to use curl instead of a browser.
+     * The same value the browser tag uses. There is no separate server
+     * credential: a server call carries no `Origin`, so the domain allowlist has
+     * nothing to check it against and accepts it.
      */
-    serverKey?: string;
+    workspaceId: string;
     event: string;
     /**
      * The visitor id the browser minted, when you have it.

package/dist/node.d.ts

@@ -37,17 +37,14 @@ interface ServerEventProperties {
     [key: string]: unknown;
 }
 interface ServerTrackInput {
-    /** Public write key. Says which workspace the event belongs to. */
-    key: string;
     /**
-     * Server key, from your Vibiz workspace. Unlike `key` this IS a credential:
-     * keep it in your environment and never send it to a browser.
+     * Your Vibiz workspace id, `org_…`. Says which workspace the event belongs to.
      *
-     * Required once the site has an origin allowlist, because a server call
-     * carries no `Origin` for that allowlist to check. Without it the allowlist
-     * would be bypassable by anyone willing to use curl instead of a browser.
+     * The same value the browser tag uses. There is no separate server
+     * credential: a server call carries no `Origin`, so the domain allowlist has
+     * nothing to check it against and accepts it.
      */
-    serverKey?: string;
+    workspaceId: string;
     event: string;
     /**
      * The visitor id the browser minted, when you have it.

package/dist/node.js

@@ -2,7 +2,7 @@
 var DEFAULT_ENDPOINT = "https://www.vibiz.ai/api/ingest";
 var PROTOCOL_VERSION = 1;
 async function track(input) {
-  if (!input.key) return { ok: false, reason: "missing key" };
+  if (!input.workspaceId) return { ok: false, reason: "missing workspaceId" };
   if (!input.event) return { ok: false, reason: "missing event" };
   if (!input.visitorId && !input.userId && !input.contact) {
     return {
@@ -12,7 +12,7 @@ async function track(input) {
   }
   const body = {
     v: PROTOCOL_VERSION,
-    k: input.key,
+    k: input.workspaceId,
     n: input.event,
     vid: input.visitorId ?? `srv-${input.userId ?? "anon"}`
   };
@@ -24,15 +24,13 @@ async function track(input) {
     body.cad = true;
   }
   try {
-    const headers = {
-      // text/plain matches what the tag sends, so both halves hit the same
-      // parsing path on the collector rather than two that can diverge.
-      "Content-Type": "text/plain;charset=UTF-8"
-    };
-    if (input.serverKey) headers["x-vibiz-server-key"] = input.serverKey;
     const response = await fetch(input.endpoint ?? DEFAULT_ENDPOINT, {
       method: "POST",
-      headers,
+      headers: {
+        // text/plain matches what the tag sends, so both halves hit the same
+        // parsing path on the collector rather than two that can diverge.
+        "Content-Type": "text/plain;charset=UTF-8"
+      },
       body: JSON.stringify(body)
     });
     return response.ok ? { ok: true } : { ok: false, reason: `HTTP ${response.status}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibiz/analytics",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Typed client for the Vibiz analytics tag.",
   "type": "module",
   "sideEffects": false,